MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f829ed079ce3010fb99eca5ee356e2ffc5ab62cedfb2683ac5ac76a66fb3ed1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LuminosityLink


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f829ed079ce3010fb99eca5ee356e2ffc5ab62cedfb2683ac5ac76a66fb3ed1
SHA3-384 hash: 8ccff831ee1a67072c087ab7df127e2b94c9ebbe31694cc5e7cdba2e2d818e55a483dd7f82482912ecf2b04685e67a8a
SHA1 hash: 4c2f83e254b12aea82fa7d3f2a1180029f2ff03e
MD5 hash: 6cd0ea4475c4565ac8862223eec509d0
humanhash: alpha-pluto-mobile-cold
File name:WhatsApp Image 2020-04-30 at 12.07.04 PM.scr
Download: download sample
Signature LuminosityLink
Create hunting rule
File size:1'765'376 bytes
First seen:2020-05-04 20:43:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:utb20pkaCqT5TBWgNQ7a3pqcbuXIrkLIIGTbiP/ok4ZWG8B0HqvD0u+IFASs1Z6A:bVg5tQ7aZq7XfPEbWo7A0KvD0DeASc5
Threatray 1'001 similar samples on MalwareBazaar
TLSH D785BF23F39A82E0F6B3523365156743FFAB6C294570F43F1F943939AB704624A4A663
Reporter abuse_ch
Tags:LuminosityLink nVpn RAT scr


Avatar
abuse_ch
Malspam distributing LuminosityLink:

HELO: p3plsmtpout004.prod.phx3.secureserver.net
Sending IP: 208.109.80.1
From: sales@loveshycosmetics.com
Reply-To: ellena14@protonmail.com
Subject: Attached is our signed PO.
Attachment: WhatsApp Image 2020-04-30 at 12.07.04 PM.z (contains "WhatsApp Image 2020-04-30 at 12.07.04 PM.scr")

LuminosityLink RAT C2:
185.165.153.39:5807

Hosted on nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacy-matters.co'

inetnum: 185.165.153.0 - 185.165.153.255
netname: PRIVACY_MATTERS
remarks: This prefix belongs to a VPN service provider.
remarks: For us the privacy of our customers matters, which means we store no logs
remarks: related to any IP addresses.
remarks: Spamhaus, please note that blacklisting the clean prefixes of our hosting
remarks: partners and upstream providers is an act of coercion and will no longer
remarks: be tolerated.
remarks: Coercion is punishable by a custodial sentence or by a monetary penalty.
remarks: If you continue such practice we will not only take legal actions against
remarks: your organization, but also make such blackmailing attempts public in the
remarks: media.
country: AT
admin-c: PMVS3-RIPE
tech-c: PMVS3-RIPE
org: ORG-PMVS1-RIPE
status: ASSIGNED PA
mnt-by: PM-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2019-10-18T13:31:16Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 12:54:39 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6bj5udzzyybb64z5ss64nlof76fvnrm5x5sna5mlldwuzx3h3iq._file
Verdict:
malicious
Similar samples:
137b5dc137f3f0c5bc3d4e1cd1f2396b33bd5b87291f72013a98b319c130b451
LuminosityLink
2db7aa7291c73bde092cd4cc8af0aff7eac7245ae5b034d8bb8810c76d85cd91
LuminosityLink
36e5646b2622d4c47947fa54a8f35c1c9d91db60ce3116e352f9f93b8a9f3ada
LuminosityLink
4249d6f93c374bf9199c33bbc49f57c1d1dd983e8c6356b5ed8739d326683c77
LuminosityLink
4c85122f83c69509a94932fa916aed7c8d8096463dbee29ccdbe3abdbd492b6a
LuminosityLink
89f5773de397e09275d7d02812ec937343e878030232964061bb6aafdea5ccde
LuminosityLink
908959fae28ad03836fb12b94a9a2f80981ec15f6481c230b9108f097edeb176
LuminosityLink
9dc8d8533e87fe22f98fb67f8705e14e93a8eeb5da355dc15251e03837334162
LuminosityLink
d8c07fc0cc1addc3f25623ac872703d2c10ae5e8fadc7370e13b4162e063a376
LuminosityLink
f428cda5f99c3961bb5532cd38f6c512cffb2a6dfc30865897e52d838c7cfef2
LuminosityLink
+ 991 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-n1nzplk2xs/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RAT_LuminosityLink
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects LuminosityLink RAT
Reference:http://malwareconfig.com/stats/LuminosityLink

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

LuminosityLink

z f016b7208c30d0011817d0e5fe217d4d83e4d11ac46ed12f06700a906910ebb0

LuminosityLink

Executable exe 5f829ed079ce3010fb99eca5ee356e2ffc5ab62cedfb2683ac5ac76a66fb3ed1

(this sample)

  
Dropped by
MD5 6a194c819862e161be0d82c98eb44807
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 f016b7208c30d0011817d0e5fe217d4d83e4d11ac46ed12f06700a906910ebb0

Comments